CVE-2026-119763: falha de média gravidade em thechangelog changelog.com
changelog.com before commit 7b35e829 Missing Authorization via Preview Routes
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 6.9epss 0.5%
changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
thechangelog · changelog.comPoCs públicas encontradas — 1
cve_referencehackmd.io/@hieund/cve-2026-119763-changelog-com-preview-unpublished-content-missing-authznão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/thechangelog/changelog.comhttps://github.com/thechangelog/changelog.com/blob/73fdd9e19cb609573f9cd8ed195cd9abaeb24f8a/lib/changelog_web/controllers/post_controller.ex#L48-L49https://github.com/thechangelog/changelog.com/commit/7b35e82934be93e8b0064299a611c98d55b3e0ebhttps://github.com/thechangelog/changelog.com/issues/581https://hackmd.io/@hieund/changelog-com-preview-unpublished-content-missing-authzhttps://hackmd.io/@hieund/cve-2026-119763-changelog-com-preview-unpublished-content-missing-authzhttps://www.vulncheck.com/advisories/changelog-com-before-commit-7b35e829-missing-authorization-via-preview-routes